AWS Security & Compliance

AWS Shield Standard

• protects against DDoS for your websites and applications

• free

AWS Shield Advanced

• 24/7 premium protection against DDoS

• protection against more sophisticated attacks on EC2, ELB, CloudFront, Global Accelerator, and Route 53

• protect against higher fees during usage spikes from DDoS

AWS WAF

• protects web applications from common web exploits

• layer 7 (HTTP)

• deploy on ALB, API Gateway, CloudFront

CloudFront and Route 53

• availability protection using global edge network

• combined with AWS Shield, provides attack mitigation at the edge

AWS Network Firewall

• protect your entire Amazon VPC

• layer 3 to layer 7

AWS Firewall Manager

• manage security rules in all accounts of an Organization

AWS Secrets Manager

• paid

• force rotation of secrets

• mostly meant for RDS

Amazon GuardDuty

• detect probs with ML

Amazon Inspector

• automated security assessments

• only for EC2, Container Images, and Lambda functions

AWS Config

• helps with auditing and recording compliance of resources

• paid

AWS Security Hub

• central security tool to manage security across several AWS accounts and automate security checks

• must first enable AWS Config

• paid

Amazon Detective

• analyzes, investigates, and quickly identifies the root cause of security issues or suspicious activities (using ML and graphs)